Information-wiping malware hitting Ukrainian computer systems shows pretend ransom demand • Graham Cluley

Somebody is concentrating on Home windows computer systems in Ukraine with malware, and for some motive they need it to appear like ransomware.

As Microsoft studies, a number of organisations in Ukraine have been focused by malware which shows what seems to be a ransom demand on boot-up.

The message saved within the onerous disk’s grasp boot file (MBR) reads as follows:

Your onerous drive has been corrupted.
In case you wish to recuperate all onerous drives
of your group,
It’s best to pay us $10k through bitcoin pockets
1AVNM68gj6PGPFcJuftKATa4WLnzg8fpfv and ship message through
tox ID 8BEDC411012A33BA34F49130D0F186993C6A32DAD8976F6A5D82C1ED23054C057ECED5496F65
together with your group title.
We’ll contact you to provide additional directions.

Nonetheless, the ransom demand is pretend. The malware – which Microsoft is looking WhisperGate – wipes information recordsdata in chosen directories on a sufferer’s laptop reasonably than encrypting them.

As soon as the malware has performed its soiled work, recordsdata with the next extensions may have been overwritten with 1MB price of “Ì” characters (0xcc in hexadecimal):

.3DM .3DS .7Z .ACCDB .AI .ARC .ASC .ASM .ASP .ASPX .BACKUP .BAK .BAT .BMP .BRD .BZ .BZ2 .CGM .CLASS .CMD .CONFIG .CPP .CRT .CS .CSR .CSV .DB .DBF .DCH .DER .DIF .DIP .DJVU.SH .DOC .DOCB .DOCM .DOCX .DOT .DOTM .DOTX .DWG .EDB .EML .FRM .GIF .GO .GZ .HDD .HTM .HTML .HWP .IBD .INC .INI .ISO .JAR .JAVA .JPEG .JPG .JS .JSP .KDBX .KEY .LAY .LAY6 .LDF .LOG .MAX .MDB .MDF .MML .MSG .MYD .MYI .NEF .NVRAM .ODB .ODG .ODP .ODS .ODT .OGG .ONETOC2 .OST .OTG .OTP .OTS .OTT .P12 .PAQ .PAS .PDF .PEM .PFX .PHP .PHP3 .PHP4 .PHP5 .PHP6 .PHP7 .PHPS .PHTML .PL .PNG .POT .POTM .POTX .PPAM .PPK .PPS .PPSM .PPSX .PPT .PPTM .PPTX .PS1 .PSD .PST .PY .RAR .RAW .RB .RTF .SAV .SCH .SHTML .SLDM .SLDX .SLK .SLN .SNT .SQ3 .SQL .SQLITE3 .SQLITEDB .STC .STD .STI .STW .SUO .SVG .SXC .SXD .SXI .SXM .SXW .TAR .TBK .TGZ .TIF .TIFF .TXT .UOP .UOT .VB .VBS .VCD .VDI .VHD .VMDK .VMEM .VMSD .VMSN .VMSS .VMTM .VMTX .VMX .VMXF .VSD .VSDX .VSWP .WAR .WB2 .WK1 .WKS .XHTML .XLC .XLM .XLS .XLSB .XLSM .XLSX .XLT .XLTM .XLTX .XLW .YML .ZIP

As well as, overwritten recordsdata are renamed with a seemingly random four-character extension.

In response to Microsoft, the assaults have been seen at a number of authorities, non-profit, and data expertise organisations.

Signal as much as our publication
Safety information, recommendation, and ideas.

I hope these organisations have the aptitude to find out how an attacker may need contaminated their techniques, and entry to a safe backup of their information recordsdata.

One huge questions goes unanswered. Who may be behind the assault, and why they may be doing it? No-one has definitive solutions for that but, however anybody who’s conserving updated with the geopolitical state of affairs within the space will seemingly have their suspicions…

Discovered this text attention-grabbing? Comply with Graham Cluley on Twitter to learn extra of the unique content material we submit.